https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-30T18:30:46.056279+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/drupal-contrib-2026-246 DRUPAL-CONTRIB-2026-246 2026-10-30T18:30:46.058652+00:00

Affected: Packagist:https://packages.drupal.org/8: drupal/tinypng

TinyPNG uses smart lossy compression techniques to reduce the file size of your PNG files.

The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than `private://`.

This vulnerability is mitigated by the fact that Drupal must be configured to use a contributed (non-core) file scheme to serve private derived images.

 https://db.gcve.eu/vuln/fkie_cve-2026-114547 fkie_cve-2026-114547 2026-10-30T18:30:46.058712+00:00

Missing Authorization vulnerability in Drupal TinyPNG allows Forceful Browsing. This issue affects TinyPNG versions: from 0.0.0 to 2.0.2.

 https://db.gcve.eu/vuln/ghsa-gjp5-2v9x-wg6m GHSA-gjp5-2v9x-wg6m 2026-10-30T18:30:46.058737+00:00

Missing Authorization vulnerability in Drupal TinyPNG allows Forceful Browsing. This issue affects TinyPNG versions: from 0.0.0 to 2.0.2.

 https://db.gcve.eu/vuln/wid-sec-w-2026-4230 WID-SEC-W-2026-4230 — Drupal Erweiterungen: Mehrere Schwachstellen 2026-10-30T18:30:46.058752+00:00

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um erweiterte Berechtigungen zu erlangen und Benutzerkonten zu übernehmen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen und nicht näher spezifizierte Auswirkungen zu verursachen.